Bug #116670 for CGI-Lite: Lite.pm bug v 3.00, 3.01

Tue Aug 02 16:02:23 2016 matt.carroll [...] ctberk.com - Ticket created

Subject:	Lite.pm bug v 3.00, 3.01
Date:	Tue, 2 Aug 2016 13:02:03 -0700
To:	<bug-CGI-Lite [...] rt.cpan.org>
From:	"Matt R. Carroll" <matt.carroll [...] ctberk.com>

I had to roll back to v2.03 due to an inconsistent bug in Lite.pm 'parse_form_data'.

The bug relates to file upload controls in some way, but I didn't track down the source within Lite.pm. parse_form_data would give consistently good results for many of my web applications, but for web applications with a file upload component sometimes it would return an empty hash, or hash with no values (I forget which; basically the form data was not correct).

Here's what I noticed:
- my web applications produced perfect HTML, with 100% consistency (tested using firebug & manually inspecting HTML).
- form submission sent the correct form data to the server ... using Apache2::RequestRec methods I confirmed that each time the form was submitted, I was able to access the form data (e.g. values for inputs) and it was correct and consistent.
- sometimes, randomly (maybe 30% of the time?), given the exact same form submission, parse_form_data would not include form data, even though I found that I could still get the form data via Apache2::RequestRec
- any time the parse_form_data method failed to return a hash ref with the form data, I would not see the warnings about $header being undefined (I believe those warnings are what you fixed in 3.01). in 3.00, anytime the form data was complete & correct, I would see the warning about $header being undefined.

The problem was observed with versions 3.00 and 3.01. I rolled back to 2.02 and now the problem is gone.

Not a lot to go on, I know; if you really need me to do some extra testing or send you html examples, I can probably find some time to do it, though my company doesn't exactly overstaff the IT department so I'm pretty busy.

-- 
Matt Carroll
IT Director, C&T Labs
(510) 990-6088

CONFIDENTIALITY NOTICE: The contents of this email message and any attachments are intended solely for the addressee(s) and may contain confidential, proprietary and/or privileged information and may be legally protected from disclosure. If you are not the intended recipient of this message or their agent, or if this message has been addressed to you in error, please immediately alert the sender by reply email and then delete this message and any attachments and the reply from your system. If you are not the intended recipient, you are hereby notified that any disclosure, use, dissemination, copying, or storage of this message or its attachments is strictly prohibited.

Tue Aug 02 16:59:52 2016 HOUSTON [...] cpan.org - Taken

Tue Aug 02 17:17:10 2016 HOUSTON [...] cpan.org - Correspondence added

Thanks for the report, Matt. Such intermittent bugs are always tricky to diagnose but there are a couple of things you could try which might alleviate it, or at least help to identify where the problem lies. Firstly, you mention the use of Apache2::RequestRec which suggests that you might be running under mod_perl. If that is the case then perhaps all you need to do is replace the calls to "parse_form_data" with "parse_new_form_data" instead. If the object isn't being reset properly between requests then this avoids problems with duplicated fields. As this was one of the bugs fixed in 2.99_04 perhaps you were getting away with (and maybe even relying on) the old, undocumented behaviour. Try that with 3.00 or newer and see if it gives consistent results. https://metacpan.org/pod/CGI::Lite#parse_new_form_data describes this method. Can I assume that when you installed 3.00 and/or 3.01 you ran "make test" and that all the tests passed? If you must use one of the older releases, do try 2.05 as it should have fixes for many of the bugs still existent in 2.02. I appreciate you may not have much time to spend debugging but if the above doesn't solve it for you then it would be very useful to have a sample test script and a data set to send it which reproduces the error. Otherwise it is very difficult to fix a problem I cannot see. Anyway, do let me know how you get on with parse_new_form_data. Hopefully that's all you need.

Tue Aug 02 17:17:10 2016 The RT System itself - Status changed from 'new' to 'open'

Tue Aug 02 17:36:50 2016 matt.carroll [...] ctberk.com - Correspondence added

Subject:	Re: [rt.cpan.org #116670] Lite.pm bug v 3.00, 3.01
Date:	Tue, 2 Aug 2016 14:36:32 -0700
To:	<bug-CGI-Lite [...] rt.cpan.org>
From:	"Matt R. Carroll" <matt.carroll [...] ctberk.com>

Thanks for the response & suggestions - I'll find some time to repeat the tests with 3.01 and try to send you something you can actually work with. 1. I did try using parse_new_form_data, but it didn't have any impact (we're not reusing the CGI::Lite object, anyway). I'll re-test to confirm and put together the simplest possible test case to demonstrate the problem. 2. I ran make test and I believe all tests passed, both with 3.00 and 3.01 - but when I roll 'back' to 3.01 I'll be sure to double check. Matt Carroll IT Director, C&T Labs (510) 990-6088 On 8/2/2016 2:17 PM, Pete Houston via RT wrote: Show quoted text

> <URL: https://rt.cpan.org/Ticket/Display.html?id=116670 > > > Thanks for the report, Matt. Such intermittent bugs are always tricky to diagnose but there are a couple of things you could try which might alleviate it, or at least help to identify where the problem lies. > > Firstly, you mention the use of Apache2::RequestRec which suggests that you might be running under mod_perl. If that is the case then perhaps all you need to do is replace the calls to "parse_form_data" with "parse_new_form_data" instead. If the object isn't being reset properly between requests then this avoids problems with duplicated fields. As this was one of the bugs fixed in 2.99_04 perhaps you were getting away with (and maybe even relying on) the old, undocumented behaviour. Try that with 3.00 or newer and see if it gives consistent results. > https://metacpan.org/pod/CGI::Lite#parse_new_form_data describes this method. > > Can I assume that when you installed 3.00 and/or 3.01 you ran "make test" and that all the tests passed? > > If you must use one of the older releases, do try 2.05 as it should have fixes for many of the bugs still existent in 2.02. > > I appreciate you may not have much time to spend debugging but if the above doesn't solve it for you then it would be very useful to have a sample test script and a data set to send it which reproduces the error. Otherwise it is very difficult to fix a problem I cannot see. > > Anyway, do let me know how you get on with parse_new_form_data. Hopefully that's all you need.

CONFIDENTIALITY NOTICE: The contents of this email message and any attachments are intended solely for the addressee(s) and may contain confidential, proprietary and/or privileged information and may be legally protected from disclosure. If you are not the intended recipient of this message or their agent, or if this message has been addressed to you in error, please immediately alert the sender by reply email and then delete this message and any attachments and the reply from your system. If you are not the intended recipient, you are hereby notified that any disclosure, use, dissemination, copying, or storage of this message or its attachments is strictly prohibited.

Tue Nov 01 19:02:52 2016 HOUSTON [...] cpan.org - Correspondence added

Hello Matt, I've heard no more about this issue and was wondering what the status is. If it is still an ongoing problem for you then we can keep the ticket open but without a short example script which demonstrates the problem there's not a great deal that can be done from this end. Equally if you've solved it please post the details so that others might benefit. Finally, if the problem has mysteriously vanished and is now no longer reproducible for you it would be good to know that too. Thanks, Pete On Tue Aug 02 22:36:50 2016, matt.carroll@ctberk.com wrote: Show quoted text

> Thanks for the response & suggestions - I'll find some time to repeat > the tests with 3.01 and try to send you something you can actually > work > with. > > 1. I did try using parse_new_form_data, but it didn't have any impact > (we're not reusing the CGI::Lite object, anyway). I'll re-test to > confirm and put together the simplest possible test case to > demonstrate > the problem. > > 2. I ran make test and I believe all tests passed, both with 3.00 and > 3.01 - but when I roll 'back' to 3.01 I'll be sure to double check. >

Tue Nov 01 19:34:00 2016 matt.carroll [...] ctberk.com - Correspondence added

Subject:	Re: [rt.cpan.org #116670] Lite.pm bug v 3.00, 3.01
Date:	Tue, 1 Nov 2016 16:33:37 -0700
To:	<bug-CGI-Lite [...] rt.cpan.org>
From:	"Matt R. Carroll" <matt.carroll [...] ctberk.com>

Hi Pete, I ended up rolling back to a much older version of Lite.pm (2.02) and that resolved the issue for me without adding any new problems. I'm guessing there are other bugs in 2.02, but none that impact us. I still hope to have free time later to dig into this more, in which case I'll provide a patch if possible (assuming there really is a bug in Lite.pm 3+), though my workload may make that a little unlikely for the near future. Matt Carroll IT Director, C&T Labs (510) 990-6088 On 11/1/2016 4:02 PM, Pete Houston via RT wrote: Show quoted text

> <URL: https://rt.cpan.org/Ticket/Display.html?id=116670 > > > Hello Matt, > > I've heard no more about this issue and was wondering what the status is. > > If it is still an ongoing problem for you then we can keep the ticket open but without a short example script which demonstrates the problem there's not a great deal that can be done from this end. > > Equally if you've solved it please post the details so that others might benefit. > > Finally, if the problem has mysteriously vanished and is now no longer reproducible for you it would be good to know that too. > > Thanks, > > Pete > > On Tue Aug 02 22:36:50 2016, matt.carroll@ctberk.com wrote:

>> Thanks for the response & suggestions - I'll find some time to repeat >> the tests with 3.01 and try to send you something you can actually >> work >> with. >> >> 1. I did try using parse_new_form_data, but it didn't have any impact >> (we're not reusing the CGI::Lite object, anyway). I'll re-test to >> confirm and put together the simplest possible test case to >> demonstrate >> the problem. >> >> 2. I ran make test and I believe all tests passed, both with 3.00 and >> 3.01 - but when I roll 'back' to 3.01 I'll be sure to double check. >>

CONFIDENTIALITY NOTICE: The contents of this email message and any attachments are intended solely for the addressee(s) and may contain confidential, proprietary and/or privileged information and may be legally protected from disclosure. If you are not the intended recipient of this message or their agent, or if this message has been addressed to you in error, please immediately alert the sender by reply email and then delete this message and any attachments and the reply from your system. If you are not the intended recipient, you are hereby notified that any disclosure, use, dissemination, copying, or storage of this message or its attachments is strictly prohibited.

Tue Nov 01 19:55:41 2016 HOUSTON [...] cpan.org - Correspondence added

Thanks, Matt. The ticket can stay open in the meantime and I will get back to you in say 6 months or so if there's been no word.

Wed May 09 04:54:09 2018 HOUSTON [...] cpan.org - Correspondence added 180 min

Hello Matt, We may have a fix for this now. A similar problem was reported at https://github.com/openstrike/perl-CGI-Lite/pull/1 and included a test to reproduce the error. The initial fix in the PR was insufficient but I believe that we now have a fix which addresses this. I'd be grateful if you could try installing the latest dev release which is available at https://cpan.metacpan.org/authors/id/H/HO/HOUSTON/CGI-Lite-3.01_02.tar.gz and let me know if this solves the problem for you. If there are no reports of any problems with this dev release in the next couple of weeks I plan to release 3.02 which will include all these changes. Thanks, Pete

Wed May 09 04:54:10 2018 HOUSTON [...] cpan.org - Status changed from 'open' to 'patched'

Wed May 09 04:54:10 2018 HOUSTON [...] cpan.org - Fixed in 3.01_02 added

Sat May 19 11:18:02 2018 HOUSTON [...] cpan.org - Correspondence added

Having received no problem reports with 3.01_02, the new production release (3.02) has been deployed today. I will close this in another couple of weeks unless there is any news.

Wed Jun 06 05:08:28 2018 HOUSTON [...] cpan.org - Status changed from 'patched' to 'resolved'